Bereinigung von Prototyp-Pollution mittels Object.create(null) in React-State-Reducern

import React, { useReducer } from 'react';
 
const DANGEROUS_KEYS = new Set(['__proto__', 'constructor', 'prototype']);
 
function safeStateReducer(state, action) {
  if (action.type === 'PATCH_UNTRUSTED') {
    const safePatch = Object.create(null);
    for (const key of Reflect.ownKeys(action.payload)) {
      if (typeof key === 'string' && DANGEROUS_KEYS.has(key)) continue;
      Object.defineProperty(safePatch, key, {
        value: action.payload[key],
        writable: true,
        enumerable: true,
        configurable: true
      });
    }
    return Object.assign(Object.create(null), state, safePatch);
  }
  return state;
}